Fix ips_out_nosa errors accounting.

ipsec6_process_packet is called before ip6_output fixes ip6_plen.
Update ip6_plen before bpf processing to be able see correct value.

We don't return sp pointer, thus NULL assignment isn't needed.
And reference to sp will be freed at the end.

Remove redundant ip6_plen initialization.

Strip IP header only when we act in tunnel mode.

Count statistics for the specific address family.